{"id":"CVE-2026-105628","published":"2026-10-05T18:17:35.917","lastModified":"2026-10-05T18:17:36.050","description":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5","tags":[]}],"exploitRefs":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5","tags":[]}],"hasPoc":true,"ai":{"summary":"Plane's OAuth avatar synchronization feature was vulnerable to server-side request forgery (SSRF) that allowed attackers to fetch internal resources and expose them via public asset URLs. This could lead to information disclosure of internal system data.","exploitability":"Moderately difficult to exploit as it requires an attacker to have access to a user account with OAuth integration and craft a malicious avatar URL that redirects to internal resources, but the attack can be automated once the initial access is gained.","blast_radius":"The impact could be significant as attackers could potentially exfiltrate sensitive internal metadata or configuration data through exposed avatar files, affecting multiple users if the vulnerability is exploited at scale.","remediation":"Upgrade to Plane 1.4.0 or later to fix the SSRF vulnerability in the OAuth avatar synchronization flow.","detection":"Monitor for unusual HTTP requests to internal IP addresses from the Plane application server, particularly those originating from OAuth avatar fetch operations, and watch for access patterns to /api/assets/v2/static/ endpoints with newly created asset IDs.","tags":["ssrf","oauth","info-disclosure","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:59:36.172Z"}}